PT-2025-47946

Name of the Vulnerable Software and Affected Versions Xtooltech Xtool AnyScan Android Application versions 4.40.40 and prior Description The Xtooltech Xtool AnyScan Android Application does not properly validate TLS certificates from its update server. This allows an attacker on the same network ...

CVE-2025-63432

The Xtooltech Xtool AnyScan Android Application (version 4.40.40 and prior ) is vulnerable to a Man-in-the-Middle (MITM) attack due to Missing SSL Certificate Validation . The application fails to properly validate the TLS certificate from its update server, allowing an attacker on the same netwo...

CVE-2025-63432: Missing Validation of OpenSSL Certificate

Xtooltech Xtool AnyScan Android Application 4.40.40 and prior is Missing SSL Certificate Validation. The application fails to properly validate the TLS certificate from its update server. An attacker on the same network can exploit this vulnerability by performing a Man-in-the-Middle MITM attack ...

CVE-2025-36161

IBM Concert 1.0.0 through 2.0.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict-Transport-Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques...

CVE-2025-36161

IBM Concert 1.0.0 through 2.0.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict-Transport-Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques...

EUVD-2025-198299

IBM Concert 1.0.0 through 2.0.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict-Transport-Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques...

Improper Certificate Validation

org.opensearch.dataprepper.plugins, opensearch is vulnerable to Improper Certificate Validation. The vulnerability is due to the plugins defaulting to a “trust-all” SSL configuration when no certificate path is provided, which allows an attacker to perform man-in-the-middle interception and...

PT-2025-47591

Name of the Vulnerable Software and Affected Versions IBM Concert versions 1.0.0 through 2.0.0 Description The software does not properly enable HTTP Strict-Transport-Security, which could allow a remote attacker to obtain sensitive information. An attacker could exploit this issue using man in t...

CVE-2025-36161: Use of a Broken or Risky Cryptographic Algorithm

IBM Concert 1.0.0 through 2.0.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict-Transport-Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques...

Security Bulletin: Erlang/OTP SSH Handshake Hardening Bypass Enables MitM Injection (Patched in OTP 25–27 Updates)

Summary Erlang/OTP is a set of libraries for the Erlang programming language. In versions prior to OTP-27.3.4 for OTP-27, OTP-26.2.5.12 for OTP-26, and OTP-25.3.2.21 for OTP-25, Erlang/OTP SSH fails to enforce strict KEX handshake hardening measures by allowing optional messages to be exchanged...

CVE-2025-60022

Improper certificate validation vulnerability exists in 'デジラアプリ' App for iOS prior to ver.80.10.00. If this vulnerability is exploited, a man-in-the-middle attack may allow an attacker to eavesdrop on and/or tamper with an encrypted communication...

Siemens SIPROTEC Inadequate Encryption Strength (CVE-2024-38867)

The affected devices are supporting weak ciphers on several ports 443/tcp for web, 4443/tcp for DIGSI 5 and configurable port for syslog over TLS. This could allow an unauthorized attacker in a man-in-the-middle position to decrypt any data passed over to and from those ports. This plugin only...

Siemens RUGGEDCOM Devices Inadequate Encryption Strength (CVE-2021-37209)

The SSH server on affected devices is configured to offer weak ciphers by default. This could allow an unauthorized attacker in a man-in- the-middle position to read and modify any data passed over the connection between legitimate clients and the affected device. This plugin only works with...

CVE-2025-60022

Improper certificate validation vulnerability exists in 'デジラアプリ' App for iOS prior to ver.80.10.00. If this vulnerability is exploited, a man-in-the-middle attack may allow an attacker to eavesdrop on and/or tamper with an encrypted communication...

EUVD-2025-197765

Improper certificate validation vulnerability exists in 'デジラアプリ' App for iOS prior to ver.80.10.00. If this vulnerability is exploited, a man-in-the-middle attack may allow an attacker to eavesdrop on and/or tamper with an encrypted communication...

CVE-2025-60022

Improper certificate validation vulnerability exists in 'デジラアプリ' App for iOS prior to ver.80.10.00. If this vulnerability is exploited, a man-in-the-middle attack may allow an attacker to eavesdrop on and/or tamper with an encrypted communication...

CVE-2025-60022

Improper certificate validation vulnerability exists in 'デジラアプリ' App for iOS prior to ver.80.10.00. If this vulnerability is exploited, a man-in-the-middle attack may allow an attacker to eavesdrop on and/or tamper with an encrypted communication...

CVE-2025-60022

The CVE-2025-60022 issue affects the iOS app デジラアプリ (versions prior to 80.10.00). Root cause: improper server certificate validation, enabling a MITM, which could allow eavesdropping or tampering of encrypted communications. Affected platforms: iOS, with impact on confidentiality/integrity as des...

"Dejira" App for iOS vulnerable to improper server certificate verification

Overview "Dejira" App for iOS provided by KDDI CORPORATION contains the following vulnerability. Improper server certificate verification CWE-295 Tsuyoshi Ogawa of SIE Co.,Ltd reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning...

CVE-2025-60022: Improper Certificate Validation

Improper certificate validation vulnerability exists in 'デジラアプリ' App for iOS prior to ver.80.10.00. If this vulnerability is exploited, a man-in-the-middle attack may allow an attacker to eavesdrop on and/or tamper with an encrypted communication...